Russia recruits ahead of elections. Cyberattacks for crypto and propaganda from Vietnam

It took just 36 minutes. According to Golden Owl researchers, that is how much time elapsed between the tragic train accident in the Spanish town of Urda and the appearance of the first online claims that the disaster was the result of deliberate sabotage.

A lack of evidence did not hinder the spread of further accusations, suggestions regarding foreign intelligence services, and materials intended to convince audiences that someone wishing to harm Spain was behind the tragedy.

This example is one of the most telling conclusions from the study „The Invisible Arsenal: Hybrid Threats to Spain 2026 Elections”, prepared by the Spanish firm Golden Owl, which specialises in open-source intelligence (OSINT) analysis.

The report describes activities preceding the snap parliamentary elections in Spain scheduled for 29 November 2026, but its significance extends far beyond the upcoming elections.

Researchers point to the coexistence of several types of threats – Russian influence operations, recruitment for cyberattacks, data theft and trafficking, fake news services, and campaigns utilising artificial intelligence.

Not all these activities share a common leadership, nor have all been attributed to Russia. However, they can mutually increase each other’s reach and effectiveness.

Russian network recruits Spaniards. Cyberattacks for cryptocurrency

Golden Owl analysed posts and activity on platforms including Facebook, Instagram, TikTok, YouTube, X, and Telegram. The analysis lasted just under three weeks. Tens of thousands of posts and nearly eleven thousand accounts were examined. The document reveals how different circles can exploit the same events, emotions, and messages to achieve diverse goals – gaining an audience, influencing public debate, recruiting collaborators, or generating profits from cybercrime.

The researchers identified nine advertisements encouraging Spaniards to join the Russian army, three calls to provide information on Spanish officials and entrepreneurs, and an invitation to participate in cyberattacks.

In the case of military recruitment, a salary of $2,500–$3,000 per month was offered, along with a $25,000 bonus for signing a contract.

A separate message concerned intelligence cooperation. Its intended recipients were citizens and officials with access to information that might interest Russian structures.

There were also calls to participate in cyber operations conducted against Western states. Participants were promised remuneration in cryptocurrencies.

Data of soldiers and officers as a tool for intimidation

Golden Owl describes more than just Russian attempts to recruit collaborators. Personal data of soldiers was also published on social media. The study also recalled previous instances of disclosing data belonging to police officers, intelligence service personnel, and the military.

This type of activity is known as doxing – publishing information that allows for the identification of specific individuals, often for the purpose of intimidation, harassment, or to facilitate further actions against them.

In the case of officers responsible for national security, the consequences can be more severe than a mere breach of privacy.

The data can be used to prepare social engineering attacks, attempt account takeovers, impersonate specific individuals, or obtain additional information regarding institutional structures.

This does not mean that every piece of disclosed information originated from a successful breach of state systems. The combination of public data, old leaks, and information obtained from other sources can also lead to the creation of a detailed profile of a specific person.

Fake Spanish media managed from Vietnam

One of the most surprising elements of the report is the activity of a network of websites and social media profiles that pose as Spanish media or local communities.

Researchers described the structure of eight Facebook pages administered from Vietnam. Collectively, they amassed approximately 270,000 followers. A significant portion of their audience consisted of older people, particularly those over the age of 65.

The mechanism of operation was relatively simple. Initially, content of a non-political nature was published. The aim was to build reach and acquire an audience, partly through paid promotion.

Subsequently, from 27 October, some of the pages began to disseminate materials concerning Spanish politics, including stories and graphics generated or altered using artificial intelligence.

The messages suggested, among other things, electoral irregularities, political conflicts, and events that did not actually take place. In some instances, the profiles presented themselves as operating within Spain, despite platform data indicating they were managed from abroad.

Golden Owl also identified similar structures geographically linked to Sri Lanka, Indonesia, Pakistan, and Argentina. This does not automatically mean that all are part of a Russian operation.

The report indicates that commercially built audience networks, functioning outside the borders of the country whose residents they seek to engage, can be utilised to manipulate public debate.

Thousands of materials regarding alleged election fraud

Golden Owl also examined messages undermining the credibility of the upcoming elections. It identified nearly four thousand materials containing allegations regarding the supposed rigging of the electoral process.

Among these were:

• 1,483 publications presenting general accusations of electoral fraud;
• 1,021 concerning postal voting;
• 760 pointing to alleged irregularities in the electoral register;
• 397 linking alleged fraud to the involvement of foreigners or new citizens.

Researchers also identified 1,075 materials providing incorrect information about electoral procedures, 716 instances of potentially synthetic content, 587 manipulated or outdated polls, and 79 cases of possible impersonation of institutions, media, or public figures.

You can read the full report below: